Technologies for multi-tenant automatic local breakout switching and data plane dynamic load balancing

Patent metadata

Field	Value
Publication number	US-12020078-B2
Application number	US-202117552833-A
Country	US
Kind code	B2
Filing date	Dec 16, 2021
Priority date	Dec 28, 2018
Publication date	Jun 25, 2024
Grant date	Jun 25, 2024

Abstract

Technologies for providing a multi-tenant local breakout switching and dynamic load balancing include a network device to receive network traffic that includes a packet associated with a tenant. Upon a determination that the packet is encrypted, a secret key associated with the tenant is retrieved. The network device decrypts a payload from the packet using the secret key. The payload is indicative of one or more characteristics associated with network traffic. The network device evaluates the characteristics and determines whether the network traffic is associated with a workload requesting compute from a service hosted by a network platform. If so, the network device forwards the network traffic to the service.

First claim

What is claimed is:

1. A device comprising:
interface circuitry to access encrypted network traffic that is associated with a tenant;
instructions; and
processor circuitry to execute the instructions to at least:
determine, based on the tenant, a mapping of an offset to the tenant, the offset indicative of a position of a first packet including a payload in a sequence of packets relative to a second packet in the sequence of packets, the sequence of packets including the encrypted network traffic;
select the first packet of the encrypted network traffic based on the mapping of the offset to the tenant;

decrypt the payload of the first packet with a secret key associated with the tenant to identify one or more characteristics of the encrypted network traffic; and
based on the one or more characteristics and one or more policies of the tenant, select a destination for a portion of the encrypted network traffic, the encrypted network traffic being associated with a workload requesting a service.

2. The device of claim 1 , wherein the first packet is at least one of (a) an initial packet in the sequence of packets or (b) an initial packet in a group of packets, individual packets of the group of packets being separated by an interval of packets.

3. The device of claim 1 , wherein the processor circuitry is to:
identify the tenant based on an identifier included with a third packet of the encrypted network traffic; and
retrieve, based on identification of the tenant, the secret key from a trusted execution environment of the device.

4. The device of claim 1 , wherein the processor circuitry is to evaluate the one or more characteristics relative to the one or more policies of the tenant.

5. The device of claim 4 , wherein the one or more policies of the tenant include one or more of a quality of service policy of the tenant, a service level agreement of the tenant, a security policy of the tenant, or a traffic policy of the tenant.

6. The device of claim 4 , wherein the processor circuitry is to subdivide, based on evaluation of the one or more characteristics relative to the one or more policies, the workload requesting the service into a first portion and a second portion, the first portion of the workload and the second portion of the workload to be offloaded to at least one of the device, one or more servers of a network platform including the device, or a compute device external to the network platform, the one or more servers of the network platform including two or more processors.

7. The device of claim 6 , wherein to subdivide the workload, the processor circuitry is to evaluate an amount of compute resources available to process the workload at the device, an amount of throughput to be utilized for load balancing the one or more servers, an amount of the one or more servers that are available to process the workload.

8. The device of claim 6 , wherein the processor circuitry is to offload one or more of the first portion of the workload or the second portion of the workload to compute resources of the device.

9. The device of claim 6 , wherein the processor circuitry is to forward one or more of the first portion of the workload or the second portion of the workload to the compute device external to the network platform according to a load balancing technique.

10. The device of claim 1 , wherein the processor circuitry is to:
retrieve a destination-specific secret key, the destination-specific secret key different from the secret key, the destination-specific key to be retrieved based on the destination;
re-encrypt, using the destination-specific secret key, a decrypted version of the portion of the encrypted network traffic; and
forward a re-encrypted version of the portion of the encrypted network traffic to the destination.

11. The device of claim 1 , wherein the processor circuitry is to perform an address translation on the encrypted network traffic.

12. A method comprising:
accessing encrypted network traffic that is associated with a tenant;
based on the tenant, determining, by executing an instruction with processor circuitry, a mapping of an offset to the tenant, the offset indicative of a position of a first packet including a payload in a sequence of packets relative to a second packet in the sequence of packets, the sequence of packets including the encrypted network traffic;
selecting, by executing an instruction with the processor circuitry, the first packet of the encrypted network traffic based on the mapping of the offset to the tenant;
decrypting, by executing an instruction with the processor circuitry, the payload of the first packet with a secret key associated with the tenant to identify one or more characteristics of the encrypted network traffic; and
based on the one or more characteristics and one or more policies of the tenant, selecting, by executing an instruction with the processor circuitry, a destination for a portion of the encrypted network traffic, the encrypted network traffic being associated with a workload requesting a service.

13. The method of claim 12 , wherein the first packet is at least one of (a) an initial packet in the sequence of packets or (b) an initial packet in a group of packets, individual packets of the group of packets being separated by an interval of packets.

14. The method of claim 12 , further including:
identifying the tenant based on an identifier included with a third packet of the encrypted network traffic; and
retrieving, based on identification of the tenant, the secret key from a trusted execution environment of a device including the processor circuitry.

15. The method of claim 12 , further including evaluating the one or more characteristics relative to the one or more policies of the tenant.

16. The method of claim 15 , further including subdividing, based on evaluation of the one or more characteristics relative to the one or more policies, the workload requesting the service into a first portion and a second portion, the first portion of the workload and the second portion of the workload to be offloaded to at least one of a device including the processor circuitry or one or more servers of a network platform including the processor circuitry, the one or more servers including two or more processors.

17. The method of claim 16 , wherein subdividing the workload includes evaluating an amount of compute resources available to process the workload at the device including the processor circuitry, an amount of throughput to be utilized for load balancing the one or more servers, an amount of the one or more servers that are available to process the workload.

18. A device comprising:
circuitry for receiving encrypted network traffic that is associated with a tenant;
means for determining, based on the tenant, a mapping of an offset to the tenant, the offset indicative of a position of a first packet including a payload in a sequence of packets relative to a second packet in the sequence of packets, the sequence of packets including the encrypted network traffic;
means for identifying, based on the mapping of the offset to the tenant, the first packet of the encrypted network traffic;
means for decrypting the payload of the first packet with a secret key associated with the tenant to identify one or more characteristics of the encrypted network traffic; and
circuitry for transmitting a portion of the encrypted network traffic to a destination selected based on the one or more characteristics and one or more policies of the tenant, the encrypted network traffic being

Assignees

• Intel Corp

Inventors

• Bernat Francesc Guim
• Smith Ned
• Doshi Kshitij
• Kondapalli Raghu
• Bachmutsky Alexander

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0464

  using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it · CPC title

• G06F2209/509

  Offload · CPC title

• G06F2209/503

  Resource availability · CPC title

• H04L47/125

  by balancing the load, e.g. traffic engineering · CPC title